Bump pgx to v5.9.2 and x/text to v0.39.0

[omlahore]

The problem

govulncheck ./... reports two vulnerabilities that your code actually reaches. Both have fixed releases available.

GO-2026-5004, SQL injection in github.com/jackc/pgx via placeholder confusion with dollar-quoted string literals. This is a direct dependency, pinned at v5.8.0:

db/query.sql.go:734:25
  db.Queries.ListVehiclesByUser -> pgxpool.Pool.Query -> sanitize.SanitizeSQL

GO-2026-5970, infinite loop on invalid input in golang.org/x/text, indirect at v0.34.0:

db/query.sql.go:973:22
  db.Queries.VehicleExists -> pgxpool.Pool.QueryRow -> norm.Form.Transform

There is no .github/dependabot.yml in the repo, so nothing was watching either of them.

The change

go get github.com/jackc/pgx/v5@v5.9.2
go get golang.org/x/text@v0.39.0
go mod tidy

Only go.mod and go.sum change. golang.org/x/sync moves from v0.19.0 to v0.21.0 as MVS resolves it.

Verification

	before	after
govulncheck ./...	2 vulnerabilities from 2 modules	No vulnerabilities found.

go build ./... clean, go test ./... passing.

Worth considering separately

Adding a .github/dependabot.yml with a gomod entry would catch the next one automatically. Can send that as its own PR if you want it, though note that Dependabot only proposes updates for direct requirements, so an indirect module like x/text still needs govulncheck in CI to be caught reliably.

Summary by CodeRabbit

• Chores
  • Updated underlying dependency versions for improved compatibility and maintenance.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 5f0c3fbd-9997-4fba-9e64-7ad67cef83b2

📥 Commits

Reviewing files that changed from the base of the PR and between 81e7433 and 82e9b1f.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates github.com/jackc/pgx/v5 from v5.8.0 to v5.9.2. It also updates indirect golang.org/x/sync and golang.org/x/text versions in go.mod.

Changes

Dependency Version Updates

Layer / File(s)	Summary
Go dependency version revisions go.mod	Updates github.com/jackc/pgx/v5 to v5.9.2, golang.org/x/sync to v0.21.0, and golang.org/x/text to v0.39.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 82e9b

This updates pgx and related Go dependencies to patched versions while preserving a passing build and test suite. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary dependency updates to pgx and x/text. It omits the indirect x/sync update, but the title does not need to include every change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}